ormandy

Several hours later, Google star vulnerability researcher Tavis Ormandy tweets(!) an embarrassing drive-by RCE in Aviator.

Edit: here [1] is discussion of Tavis Ormandy / Google's new 7 day policy.

Tavis Ormandy went into more detail on the math here, but it's not great!

None of this is to say you shouldn't use Anubis, but Tavis Ormandy is offering a computer science critique of how it purports to function.

> Several hours later, Google star vulnerability researcher Tavis Ormandy tweets(!) an embarrassing drive-by RCE in Aviator.

• And Tavis Ormandy found and resurrected the final ever terminal-mode text-only WordPerfect for Linux, relinking it for x86 Linux.

Tavis Ormandy got it working on Linux[0].

So I'm glad professional-random-Internet-bullshit-ignorer Tavis Ormandy wrote this one.

This came up before (and this post links to the Tavis Ormandy post that kicked up the last firestorm about Anubis) and without myself shading the intent or the execution on Anubis, just from a CS perspective, I want to say again that the PoW thing Anubis uses doesn't make sense.

The "Making Software Dumber" talk by Travis Ormandy (Google) should be interesting for anyone doing fuzzing research, or just curious about fuzzing in general.

Now Ormandy's employer, Google, has stepped in and sided with Ormandy.

Tavis Ormandy's post goes into more detail about why this isn't a substantial cost for AI vendors.

Moore, Dan Kaminsky, Tavis Ormandy, Michał Zalewski, even our own Colin Percival and tptacek etc.